Cisco Talos researchers uncovered CLOSEDQUORUM, a Windows malware tool that autonomously consults four large language models—DeepSeek, Qwen, Mistral and Google Gemini—to decide follow-up actions on compromised machines without human operators. The malware is designed to steal login credentials and cryptocurrency, and appears linked to cybercrime forum activity involving credit-card fraud dating back to 2025, though investigators have not confirmed real-world deployment or identified its creators. CLOSEDQUORUM illustrates a shift toward AI-driven command-and-control infrastructure, as tracked by Cisco Talos’s new open-source CAIRN framework, which fingerprints AI use in malware and reveals a broader, still largely experimental ecosystem of AI-integrated threats.
This update represents a notable development in the Ai sector. Organizations and founders tracking this space should evaluate potential strategic and technical implications on their operations.